This invention relates to storage area networks, and in particular, to security of data in such storage area networks.
Storage area networks (SAN) are now widely deployed around the world to provide storage facilities for computing environments. The consolidation of storage into large facilities allows for more efficient administration and control, and enables the provision of highly reliable backup and redundancy systems to dramatically limit data loss from system failures or natural catastrophes. The benefits of such storage have caused a dramatic increase in its use throughout the world.
Storage area networks are designed to allow access from many different host systems so the data may be reliably retrieved and stored from different locations under the control of different processors. Such storage and retrieval is often carried out over public networks, such as the internet.
To more effectively enable access to the storage system, it is usually configured into smaller portions which can be allocated to different processors or other resources requiring the storage. For example, conventional storage systems include a large number of hard disk drives, with each hard disk drive itself including many gigabytes of storage. One way to divide the storage resource into smaller portions is to create Logical Units that are assigned a unique Logical Unit Number. Each LU itself consists of a numeric address, thereby permitting the large storage system to appear as many smaller storage units to the host computers accessing them, enabling more efficient operation.
The LUs are typically assigned to hosts so that a particular LU may be accessed only by designated hosts which have “permission” to access that portion of the storage system. This provides enhanced security as the software controlling access to the storage system will only permit access by certain previously defined hosts. While it is somewhat arbitrary how many hosts are permitted to access a given LU, conventionally only one host usually has access rights to a given LU at a given time. In this manner the data on the LU is protected against access by hosts or servers other than those previously designated, thereby enhancing the security of the data.
The SAN itself usually consists of one or more disk array devices, for example configured under a selected RAID protocol, with multiple host devices connected by fiber channel switch network devices or other well known means to the storage area network. Inside the architecture, host computers run cluster management software to negotiate with each other to determine which hosts “own” which portions of the storage or LUs. A commonly known “failover” function enables the clustered architecture of the SAN to be highly available. In a failover situation, a failure occurs, but is made relatively transparent to the user of the system by transferring operations that were running on one node to another node or nodes within that cluster of nodes.
The hosts and SAN are configured in a clustered environment in which more than one host has access to a given SAN. The host is typically a computer, for example an application server or a database server. The traditional clustering software used to provide this configuration has a limitation in that a portion of the storage, for example, an LUN, must be configured to allow I/O access from all host nodes in the cluster. For example, if host node A is running an application X, and they are in the same cluster, it is desirable that if host A fails, the task of application X be taken over by another host B. When this happens the LU security for applications must be set to allow I/O access from both hosts A and B. If such multiple access is routinely provided by the set-up program at system initialization, however, it can be a cause of data corruption resulting from the wrong access of the data.
This invention provides an improved method and system for security in such an environment by enabling dynamic changes in the LU security to allow a different host to access a particular portion of the storage after a failure, when that host could not have accessed that portion of the storage before the failure.